A WordPress care plan should cover, at minimum, updates tested on a staging copy and daily off-site backups. It should monitor security, uptime and performance, and alert you when something changes. You should have a named person to contact. Each month’s report should say what was done, what was found and what to act on.
Many of the people who ask me about a care plan turn out to need a rebuild first. Open up a site built on a cheap theme, forty plugins and the cheapest host going, and the reason is usually clear. A care plan is a maintenance contract. It can’t undo years of bad decisions, and it won’t make a broken site safe.
This guide covers what a plan should include, the warning signs in a provider, and how to tell whether your site is ready for a plan at all.
What a care plan should include
Treat this as the minimum. If a provider offers less, keep looking.
- Tested updates on staging. Core, plugins and themes updated on a staging copy first, and put live only when nothing breaks.
- Daily off-site backups, with at least one copy kept outside your hosting environment. Backups in one place fail with that place.
- Security monitoring. Malware scanning, a firewall, login protection and alerts when something changes, included rather than sold as an extra.
- Uptime monitoring, with an alert as soon as the site goes down.
- Performance monitoring that flags a site getting slower before it fails.
- A named person you can reach when something’s wrong, rather than a ticket queue.
- Monthly reports that say what was done, what was found and what you should do about it.
What I find when I take on a site
I’ve opened up a lot of WordPress sites that were sold to their owners as “fully managed”. The same problems come up again and again.
Vulnerable plugins left running
Plugins pinned to old versions for months, sometimes years, because updating them would break the theme. Locking the version only hides the known vulnerability from the owner. It stays public for anyone looking for it.
Forced-version hacks
Someone edited a plugin’s files so the update notice would stop appearing. The plugin still worked. It was also three major versions behind and leaking form submissions.
Bloated off-the-shelf themes
Elementor, WPBakery, Revolution Slider and a visual form builder, all loading on every page. The homepage took several seconds to appear, while the owner paid a previous provider every month for “speed optimisation” that changed nothing they could measure.
Too many plugins
Forty or more plugins where eight would have done the job, half of them abandoned by their developers years ago. Every update risked breaking something else.
No backups worth the name
No backups at all. Or backups nobody had ever tested. Or backups kept on the same server that was compromised.
None of this is the owner’s fault. They bought a care plan in good faith. This is the real cost of ignoring WordPress maintenance, arriving slowly.
Bad care plan vs good care plan, at a glance
If you’re comparing providers, check their proposal against this table.
| What to check | Bad care plan | Good care plan |
|---|---|---|
| Update cadence | Monthly, or whenever they get round to it | Security patches as soon as they’re tested, major versions as projects |
| Staging environment | None, so changes go straight to the live site | A staging copy that matches the live site, where updates are tested |
| Backups | One copy, on the same server | Daily and off-site, away from the host, hourly for shops |
| Backup testing | Never restored, never checked | Restores practised on a schedule |
| Security | Sold as an extra or a higher tier | Included: monitoring, a firewall, malware scanning and alerts |
| Uptime monitoring | Checked by hand, now and then | Checks from several locations, with alerts |
| Performance | Measured only after something fails | Budgets set, and slowdowns flagged before visitors notice |
| Support | A ticket queue and a fixed wait | A named person you can reach directly |
| Reporting | ”We ran updates”, or nothing | What was updated, what was found, what’s trending and what to act on |
| Documentation | None, so the process is whatever they remember | A written runbook, a change log and a handover of credentials |
| Ownership | Site registered under the provider’s account | Site and hosting under your account from the first day |
Red flags when you’re comparing care plans
- “We update monthly.” Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% rise on the year before. A patch that waits for a monthly round leaves the site open for weeks. Keeping WordPress updated means patching within days of a release.
- One backup location. Usually the same server as the site, so when the site goes down the backup goes with it. Ask for an off-site copy as standard.
- No staging environment. Updating the live site and hoping is a risk to your business, and a staging copy removes it.
- Security as a premium tier. Protection against hacking belongs in the basic plan.
- “Unlimited everything.” Ask exactly what’s capped, and where.
- Slow support. If your site is down for two days before anyone looks at it, you’ve lost two days of sales and some of your customers’ trust.
- No written process. A provider who can’t show you what they do each month probably doesn’t do it the same way twice.
Is your site worth maintaining yet?
A care plan assumes there’s a car worth servicing. If the engine has seized, oil changes won’t help, and some sites are in that state when their owners come looking.
Signs your site needs a rebuild before it needs a care plan:
- The original developer has abandoned the theme or page builder.
- Dozens of plugins, many out of date, do jobs WordPress core now handles.
- Pages take more than five seconds to load on a decent connection.
- Accessibility you’d struggle to defend if anyone audited it.
- A design that looked modern in 2018.
If that sounds like your site, the conversation is about rebuilding on something maintainable first, then putting maintenance around it. Over three years, that’s usually the cheaper option.
What good maintenance looks like
A staging environment that matches the live site
Updates, new plugins and code changes go there first and get tested. Only then do they reach the live site.
Update discipline
Security patches go on as soon as they’ve been tested, rather than on a monthly cycle. Major version updates are treated as small projects, with a way to roll back.
Off-site backups sized to your risk
Daily at the least, hourly for shops, and always on storage independent of your web host. Restores are tested on a schedule, so nobody has to assume they work.
Monitoring someone reads
Uptime checks from several locations. Performance budgets that flag a site starting to slow down. Security events logged and reviewed, rather than left until Wordfence sends an email.
Reports you can act on
More than “we ran updates”: what was updated, what was found, what’s trending the wrong way and what to think about next quarter.
A person to call
Someone who knows the site, and whom you can reach when it matters.
Working with me
I look after WordPress sites for Cheshire businesses on maintenance cover agreed for each site. It starts with a health check, which also tells you whether the site needs a fix before it needs a plan.
Frequently asked questions
What should a WordPress care plan include as a minimum?
Updates tested on a staging copy, daily backups with at least one copy outside the hosting environment, security monitoring with alerts, uptime and performance monitoring, a named person you can reach directly, and monthly reports that say what was done, what was found and what to act on.
How often should WordPress be updated?
Security patches should go on as soon as they've been tested, rather than waiting for a monthly round. Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025. Major version updates are best treated as small projects, with a staging copy and a way to roll back.
How do I spot a bad WordPress maintenance provider?
Be wary if they only update monthly, keep backups on the same server as the site, work on the live site with no staging copy, charge extra for security, promise unlimited work without saying where the limits are, or can't show you their process in writing.
When does a WordPress site need rebuilding instead of maintaining?
When the theme or page builder has been abandoned by its developer, dozens of plugins do jobs WordPress core now handles, pages take more than five seconds to load, accessibility wouldn't survive an audit, or the design looks dated. A care plan can't fix a broken foundation, and maintaining one usually costs more over three years than rebuilding.
What does good WordPress maintenance look like?
A staging copy that matches the live site, security patches applied once tested, daily off-site backups (hourly for shops), uptime checks from several locations, performance budgets that flag a slowdown early, security events logged and reviewed, monthly reports you can act on, and a named person you can reach.
Published , updated .